SCS-C02 Threat Detection and Incident Response Practice Test 15 — 15 Questions

Question 1

A security engineer runs the above AWS CLI command to search for CreateKey events in CloudTrail. The command returns no events, but the security engineer knows that a KMS key was created in us-east-1 on January 1, 2023. What is the most likely reason for the empty result?

Accepted Answer

The CloudTrail trail is not multi-region and is configured in a different region. Option A is correct because the event name for creating a KMS key is 'CreateKey' but the correct API call is 'CreateKey' for KMS? Actually, the CloudTrail event name for creating a KMS key is 'CreateKey'. However, the issue might be that the event is logged under a different name? Wait, the correct event name is 'CreateKey' indeed. But the output is empty. Option B: CloudTrail might not be logging KMS events? Option C: The time range might be wrong? Option D: The region might be wrong. The most likely reason is that the CloudTrail trail is not enabled in us-east-1 or the event was not captured due to trail configuration. Option A is plausible but not specific. Actually, the command shows no events, but KMS key creation is a data event for KMS. CloudTrail by default only logs management events, not data events. KMS key creation is a management event? Actually, CreateKey is a management event. So it should be logged. The most likely is that the trail is not configured to log management events in that region, or the trail is not multi-region. Option D: The correct event name might be 'CreateKey' but the API is 'CreateKey' for KMS; there is no other event name. Option C: The time range is correct. Option A: The key was created but the event might be logged under a different event name? Not really. The most common cause is that the CloudTrail trail is only logging events for a specific region, not us-east-1. So the correct answer is B? Let's think: The command specifies region us-east-1. If the trail is not multi-region and is in another region, the event will not be visible. So option B: The trail is not multi-region and is configured in a different region. That makes sense. But the exhibit does not show trail configuration. Option D: The event name should be 'CreateKey' but maybe it's 'CreateKey'? Actually, it is correct. So I'll go with B.

Answer

The event name is incorrect; the correct event is 'CreateKey' but it is case-sensitive

Answer

The user does not have permission to view KMS events in CloudTrail

Answer

The time range specified is outside the retention period of CloudTrail

Question 2

The above condition is added to an S3 bucket policy to restrict access to a specific VPC endpoint. An EC2 instance in the same VPC is unable to access the bucket. What is the most likely reason?

Accepted Answer

The resource ARN in the policy is for EC2, not for S3. Option C is correct because the condition uses aws:SourceVpce, which checks the VPC endpoint ID. However, if the EC2 instance is accessing S3 through a gateway endpoint (not interface endpoint), the sourceVpce condition will not match because gateway endpoints do not provide a VPC endpoint ID in the request. Option A is wrong because the resource ARN is for EC2 instances, but the policy is for S3 bucket? Actually, the exhibit shows a condition, not a full policy. The condition is likely part of an S3 bucket policy. The resource ARN for S3 would be different. The exhibit shows a resource ARN for EC2, which is suspicious. Actually, the exhibit shows Resource: "arn:aws:ec2:..." which is incorrect for S3. That might be the problem. Option D: The resource ARN is for EC2, not S3. So the policy is malformed. The most likely reason is that the resource ARN is incorrect. So option D. Let's re-evaluate: The exhibit shows Resource: "arn:aws:ec2:..." but the condition is for S3? The stem says 'added to an S3 bucket policy'. So the resource ARN should be for S3. Therefore the policy is invalid. So answer D.

Answer

The condition should use aws:SourceVpc instead of aws:SourceVpce

Answer

The EC2 instance does not have a public IP address

Answer

The VPC endpoint policy does not allow the s3:GetObject action

Question 3

A security engineer is investigating a potential compromise of an EC2 instance. The engineer needs to capture network traffic to and from the instance for forensic analysis. Which AWS service should be used to capture this traffic?

Accepted Answer

VPC Traffic Mirroring. VPC Traffic Mirroring captures and inspects network traffic at the Elastic Network Interface (ENI) level by copying packets from a source ENI to a target, such as a Network Load Balancer or another ENI. This allows the security engineer to perform deep packet inspection and forensic analysis without impacting the production traffic flow. It supports both IPv4 and IPv6 traffic and can filter by protocol, port, or packet direction, making it ideal for incident response scenarios.

Answer

AWS Config

Answer

AWS Network Firewall

Answer

Amazon Inspector

Question 4

A company uses AWS Organizations with multiple accounts. The security team wants to automatically receive alerts when an IAM user attempts to access resources they do not have permissions for, across all accounts. Which combination of services should be used?

Accepted Answer

Amazon GuardDuty and AWS Security Hub. Amazon GuardDuty continuously monitors for suspicious activity, including unauthorized API calls or failed access attempts, across all accounts in an AWS Organization. Security Hub aggregates these findings from GuardDuty and other services, enabling automated alerts via integrations like Amazon SNS or AWS Chatbot. Together, they provide a centralized, cross-account threat detection and alerting solution that meets the requirement of notifying the security team when IAM users attempt unauthorized resource access.

Answer

Amazon Inspector and AWS Lambda

Answer

AWS Config and Amazon SNS

Answer

AWS CloudTrail and Amazon CloudWatch Logs

Question 5

During an incident response, a security engineer needs to collect volatile memory from a compromised EC2 instance without affecting the running system. The instance is critical and cannot be stopped. Which approach is most appropriate?

Accepted Answer

Use AWS Systems Manager Run Command to execute a memory capture utility.. Option D is correct because AWS Systems Manager Run Command allows you to execute a memory capture utility (such as WinPmem or LiME) on the EC2 instance without stopping it, preserving volatile memory for forensic analysis. This approach uses the SSM Agent to run commands remotely, minimizing impact on the running system while collecting critical evidence like running processes, network connections, and kernel data.

Answer

Stop the instance, detach the root volume, and attach it to a forensics instance for analysis.

Answer

Use AWS License Manager to create a snapshot of the instance memory.

Answer

Use Amazon EC2 Rescue to collect memory dump.

Question 6

A security team wants to detect unauthorized API calls in real time and automatically block the source IP address using network ACLs. Which AWS service should be used for detection?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty is the correct choice because it is a threat detection service that continuously monitors for malicious activity and unauthorized behavior, including API calls from unusual or known-bad IP addresses. It uses machine learning, anomaly detection, and integrated threat intelligence to generate findings that can trigger automated remediation, such as updating network ACLs via AWS Lambda and Amazon EventBridge. This aligns with the requirement for real-time detection and automated blocking of source IPs.

Answer

AWS CloudTrail

Answer

AWS WAF

Answer

AWS Config

Question 7

A company is designing an automated incident response workflow. When a high-severity GuardDuty finding is generated, the security team wants to automatically isolate the affected EC2 instance by modifying its security group to deny all traffic. Which service should orchestrate this response?

Accepted Answer

AWS Systems Manager Automation. AWS Systems Manager Automation is the correct choice because it provides a pre-built runbook (AWS-DetachAndIsolateEC2Instance) that can be triggered by Amazon EventBridge when a GuardDuty finding is generated. This runbook automatically modifies the EC2 instance's security group to deny all traffic, effectively isolating the instance without requiring custom code. Systems Manager Automation is designed for such operational workflows, offering built-in error handling and approval steps.

Answer

AWS Lambda

Answer

AWS Config

Answer

AWS Step Functions

Question 8

A security engineer is investigating a potential data exfiltration from an S3 bucket. The engineer has enabled S3 server access logs and CloudTrail data events. Which log source would provide the most granular details about the request, including the requester's IP address and user agent?

Accepted Answer

Amazon S3 server access logs. S3 server access logs provide detailed records of each request, including requester IP, user agent, and operation. CloudTrail data events also log S3 operations but may not include the user agent. VPC Flow Logs capture network traffic but not application-level details. AWS CloudWatch Logs is not the source.

Answer

VPC Flow Logs

Answer

AWS CloudTrail data events

Answer

Amazon CloudWatch Logs

Question 9

A company needs to ensure that all API calls in their AWS account are logged and monitored for suspicious activity. Which service should be enabled first?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls in the account. GuardDuty uses CloudTrail logs for threat detection, but CloudTrail must be enabled first. AWS Config is for configuration compliance. Amazon Inspector is for host vulnerabilities.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Config

Question 10

During an incident response, a security engineer needs to preserve the state of an EC2 instance's root volume for forensic analysis. The instance is still running. Which action should be taken to ensure the data is preserved without altering it?

Accepted Answer

Create a snapshot of the root volume.. Creating a snapshot of the root volume is the correct action because it captures a point-in-time, crash-consistent copy of the volume's data without requiring the instance to be stopped or the volume to be detached. This preserves the current state of the running instance for forensic analysis while ensuring the data is not altered by the snapshot process itself, as AWS snapshots are read-only and do not modify the source volume.

Answer

Stop the instance and then create an AMI.

Answer

Use dd if=/dev/xvda over SSH to copy the volume.

Answer

Detach the root volume and attach it to a forensics instance.

Question 11

A security engineer notices that an EC2 instance is sending outbound traffic to a known malicious IP address. The engineer needs to quickly block all traffic to that IP while preserving the instance for forensic analysis. Which approach is the most effective?

Accepted Answer

Modify the instance's security group to deny outbound traffic to the malicious IP.. Modifying the security group to deny outbound traffic to that IP is quick and reversible. Using NACLs is slower and affects subnets. Stopping the instance loses volatile data. Route table modification is not effective for a single IP.

Answer

Stop the instance immediately.

Answer

Add a network ACL rule to deny outbound traffic from the instance's subnet to the malicious IP.

Answer

Modify the route table to route traffic to the malicious IP to a blackhole.

Question 12

Which TWO AWS services can be used to detect anomalous behavior in an AWS environment?

Accepted Answer

Amazon GuardDuty. Amazon GuardDuty and AWS Security Hub both provide anomaly detection. GuardDuty uses machine learning to detect threats. Security Hub aggregates findings and can detect anomalies through integrated services. AWS Config is for compliance. AWS CloudTrail is logging. Amazon Inspector is for vulnerabilities.

Answer

AWS Config

Answer

AWS CloudTrail

Answer

Amazon Inspector

Question 13

Which THREE actions should be taken when preparing an incident response plan for AWS?

Accepted Answer

Enable AWS CloudTrail in all regions.. AWS CloudTrail must be enabled in all regions to ensure that all API calls across the entire AWS infrastructure are logged. This provides a comprehensive audit trail essential for forensic investigation and identifying the scope of a security incident. Without multi-region CloudTrail, an attacker could operate in an unmonitored region, leaving no trace for incident responders.

Answer

Share the AWS account root user password with the incident response team.

Answer

Disable VPC Flow Logs to reduce log volume.

Question 14

Which TWO steps are part of the forensic acquisition process for an EC2 instance suspected of being compromised?

Accepted Answer

Capture the instance's memory using a forensic tool.. Option D is correct because capturing the instance's memory using a forensic tool (such as LiME or F-Response) preserves volatile data—including running processes, network connections, and encryption keys—that would be lost if the instance were stopped or terminated. This is a critical step in the forensic acquisition process to gather evidence of compromise without altering the system state.

Answer

Stop the instance immediately to prevent further damage.

Answer

Enable termination protection on the instance.

Answer

Terminate the instance to ensure the threat is contained.

Question 15

Refer to the exhibit. A security engineer is reviewing an S3 bucket policy. The policy is intended to allow read access to objects in the bucket only from the corporate network (203.0.113.0/24). However, users outside the network can still access the bucket. What is the most likely reason?

Accepted Answer

The bucket policy does not include an explicit Deny statement for IP addresses outside the allowed range.. The bucket policy alone is not sufficient; the bucket must also block public access. A bucket policy that grants access to a specific IP range still allows access to anyone who can satisfy the condition. However, if the bucket's block public access settings are not configured, anonymous users could bypass the policy? Actually, the policy allows access only from that IP, but if the bucket is not public, only authorized IAM users can access. The issue could be that the policy doesn't deny access from other IPs. The correct answer is that the policy allows access but does not explicitly deny access from other IPs. A more correct policy would include a Deny statement. The other options: Users are using pre-signed URLs would bypass IP restriction. The bucket policy has a typo? The resource is correct. The condition key is correct. The most likely reason is that the policy allows access but does not deny access from other IPs. However, among the options, the best is that the policy does not include an explicit Deny for other IPs.

Answer

The s3:GetObject action is misspelled; it should be s3:GetObjectVersion.

Answer

The condition key should be aws:SourceIp instead of aws:SourceIp.

Answer

The bucket policy must be attached to the bucket's ACL instead.